1. Operator and scope

Home-booking is operated by iHouse株式会社 (also styled iHouse 株式会社; “iHouse”, “we” or “us”). Company website: https://ihousejapan.com. Service and privacy contact: support@ihousejapan.com.

Company address: 大阪市中央区南船場3丁目11-10 心斎橋大陽ビル5階3号室, Japan; representative 片岡 瑞明; telephone +81-6-6926-8191. Effective date: 6 November 2026. Version 1.1.

This notice covers our accommodation information, agency booking requests, quotes, approvals, order follow-up and support. Our intended model is that the customer pays iHouse and iHouse arranges and pays the accommodation supplier. iHouse may receive a supplier-paid commission under a separate agreement.

The service includes email sign-in, booking requests and operator-verified facts. Live inventory and automatic supplier booking are not connected. Online checkout is offered only when the relevant merchant channel is explicitly enabled; a test checkout never makes a real charge. This notice does not itself activate those features or establish a supplier/payment-provider relationship. New integrations require an updated account of the actual data flows before use.

2. Information collected

We limit collection to what is needed for the requested service:

• Guest name, email, property and room, stay dates, guest count, contact consent and necessary customer-supplied request information.
• A verified customer identifier, platform/channel, permission scope and authentication/security records. Current access credentials are stored as hashes. A future platform account link must map to the correct verified customer.
• Request identifiers, relevant property snapshots, quotes, amount/currency, expiry, original cancellation terms, specific customer approvals, order events, supplier references and necessary support correspondence.
• Where actual transactions occur, verified payment/refund amounts, transaction and evidence references, supplier payments and reconciliation records. Operator records do not themselves execute a payment.
• IP addresses and other access/security metadata needed for operation, troubleshooting and abuse prevention.

Do not put full card details, bank passwords, authentication codes or passport copies in an agent conversation or ordinary request. A supplier requiring lawful check-in identification must explain and collect it through the appropriate process; it is not permission for an agent to collect it in chat.

3. Purposes and limits

We use information to answer inquiries, verify access, obtain quotes, arrange an approved stay, collect/refund an agreed amount through an enabled method, follow up, provide support, reconcile records, meet applicable obligations and protect the service. Quote and consent records preserve what the customer actually authorized.

Our policy: we do not sell private booking information, use it for unrelated advertising or train our own AI models on it. Any marketing permission is separate from booking consent. The external agent platform handles its own conversation/account data under its own policies; this statement does not describe that platform's independent practices.

4. Access, suppliers and other recipients

Access is limited to authorized iHouse staff who need it for fulfillment, support, accounting or security. Customer order tools are limited by server-verified identity and permissions.

For supplier fulfillment, we identify the actual supplier and share only the guest/stay/contact information needed for the selected service, with the necessary authority and consent. A public listing alone is not an agency agreement. An enabled payment provider receives necessary payment/refund information through its secure flow; its identity and relevant handling must be disclosed before use. Stripe is the selected hosted payment provider. Payment details are entered on Stripe pages; iHouse does not collect full card numbers or payment passwords. A disabled or test channel does not authorize a real payment.

Resend sends sign-in codes and transactional order notifications from mail.ihousejapan.net. It receives the recipient email address, the one-time sign-in code where needed, or an order reference and a minimal status message. We do not include guest identity documents or payment-card details in these messages. The sending region is configured as Tokyo; that setting is not a claim that all provider storage, support or processing remains in Japan. Resend handles its service data under its published privacy terms.

The agent platform chosen by the customer receives information through the authorized interaction. One customer's credential must not expose another customer's orders. Hosting and support processors may handle limited information required for their services, with appropriate access and handling arrangements. Other disclosure is limited to what applicable law permits or requires, or what is necessary for a valid claim.

Our service database is administered for iHouse. Contact our privacy address for current hosting/access locations and recipient details. Stripe is selected for hosted checkout; activation depends on the merchant configuration. Resend sends authentication and order emails. Supplier submission is manual. Before enabling a relevant new disclosure or transfer, we identify its actual recipient and required location information. International access/transfer is assessed before activation, with the required information and consent or other applicable arrangements. An unknown destination is not unrestricted worldwide-sharing permission.

5. Retention and deletion

We apply the following retention schedule, with documented exceptions for unresolved matters and applicable obligations:

A documented dispute, incident, unpaid obligation or required preservation may justify longer retention of relevant information. It does not justify retaining every field indefinitely. When the reason ends, the applicable deletion/de-identification schedule resumes. Credential revocation stops access, but does not automatically erase evidence that must still be retained.

Guest/contact content is removed through controlled retention procedures. A verified privacy request can also be reviewed by an operator; this is not an automatic erasure of financial records or every historical field. A backup restore must reapply deletion restrictions instead of returning deleted data to ordinary use.

6. Privacy requests

Contact support@ihousejapan.com to ask about use, access, correction, restriction or deletion of your information, or raise a concern. We may request proportionate identity verification; do not send extra identity documents unless we explain a necessary secure method.

Our response targets: acknowledge within 3 business days and provide a substantive response or explanation of next steps within 30 calendar days, subject to any shorter mandatory deadline and a lawful extension explained to you. If some records must be kept, we explain the reason and restrictions rather than falsely claiming everything was erased. Business days follow the Japan-time support schedule in the Service Terms.

7. Security, children and cookies

We use HTTPS, restricted customer permissions, administrator authentication and checks on operator actions. Guest/contact request snapshots are encrypted. This is not a claim that every database field is encrypted, that no incident can occur or that the service has an independent certification.

A person providing another guest's information must have authority to do so; obtain guardian consent where required for a child. We do not request children's advertising profiles. Necessary authentication/security mechanisms may be used. Any future optional analytics/marketing technology needs appropriate notice and choices before activation.

8. Changes and contact

We identify the effective version/date and give appropriate notice of material changes. Existing quote approvals are not silently rewritten. Additional consent is obtained where required for materially different use or sharing. Questions and complaints: support@ihousejapan.com.